Senior DFIR Lead & Ransomware Negotiator

LevelBlue, LLC.; United States; Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Comprehensive medical, dental, and vis

Job summary

LevelBlue, LLC. is seeking a highly skilled Digital Forensics and Incident Response practitioner to join our Global LevelBlue DFIR team. You will investigate and respond to cybersecurity incidents, conduct digital forensics, and report findings to clients with clarity for non-technical audiences.

The role also covers Threat Actor communications, ransom negotiation support, and coordinating across time zones. A strong technical background and on-call availability are essential for success.

Qualifications

• Strong knowledge of digital forensics tools and techniques, including X-Ways, or similar forensic tooling.
• Experience with incident response frameworks (NIST, SANS).
• Excellent written and verbal communication; ability to document clearly.
• Ability to lead responses to cybersecurity incidents and coordinate teams.
• Experience in Threat Actor communications and ransomware negotiations.

Responsibilities

• Lead and coordinate responses to cybersecurity incidents from containment to recovery.
• Analyze security breaches to determine root cause and impact.
• Conduct DFIR investigations across servers, workstations, networks, and SaaS.
• Collect, preserve, and analyze digital evidence per legal requirements.
• Support on-call duties during time-sensitive incidents.

Skills

DFIR leadership

Incident response

Threat actor negotiations

Technical writing

Communication

Education

Bachelor's or Masters degree in Digital Forensics or Computer Science or closely related field

Tools

X-Ways

Job description

LevelBlue, LLC. is seeking a highly skilled Digital Forensics and Incident Response practitioner to join our Global LevelBlue DFIR team. You will investigate and respond to cybersecurity incidents, conduct digital forensics, and report findings to clients with clarity for non-technical audiences.

The role also covers Threat Actor communications, ransom negotiation support, and coordinating across time zones. A strong technical background and on-call availability are essential for success.